ChronoVerify is a C2PA Conformant Validator: what the listing covers, and what it does not

A note from ChronoVerify, built and maintained by a veteran intelligence analyst. Published July 29, 2026

ChronoVerify is listed on the C2PA Conforming Products List as a conformant validator product, record 019f8a20-6452-7a43-b11b-59d0b0e4a84a. The list is a public file maintained by the standards body, not by us, so the fastest way to read the rest of this post is to go check the record first in the C2PA's own conformance explorer and come back.

Provenance tooling is a field where every product describes its own rigor, at length, in its own words. A line in someone else's register is a different kind of statement, and you can check it without asking us.

What the record says

Product type: validatorProduct. ChronoVerify sits on the reading side of C2PA. It takes an image someone else made, finds the Content Credential if there is one, and tells you whether the signature, the trust chain, and the claim hold up.

Generates: nothing. That field is empty on purpose. ChronoVerify does not mint Content Credentials and does not sign anything on your behalf. The limit is in the public record, so any future sentence from us claiming otherwise is checkable and wrong.

The raw version, straight from the register:

curl -s https://raw.githubusercontent.com/c2pa-org/conformance-public/main/conforming-products/conforming-products-list.json \
  | jq '.[] | select(.recordId=="019f8a20-6452-7a43-b11b-59d0b0e4a84a")'

Conformance is not certification

A product goes through the C2PA's conformance program against a stated specification version. The outcome is public, and the status can change later.

It is not a certification, an audit, or an endorsement. Those three words get thrown around loosely, usually by products with nothing in any register. We are not going to use them. The record does not support them, and the first serious buyer who checks would notice.

There is also no such thing as an EU AI Act certified image checker. If a vendor offers you one, they are offering you a logo.

The list is lopsided

Counts below come from the raw list on July 29, 2026. The list changes, so read them as a dated snapshot. We keep a page that shows how they are derived, including the table of every validator product on the list.

• 144 records in total.
• 124 generator products: the cameras, editors, and signing services that create Content Credentials.
• 20 validator products, from 18 distinct vendors. That is the entire reading side of the list.

One hundred twenty-four products can put a Content Credential into an image. Twenty are registered to check one. That ratio is the practical shape of the provenance problem right now.

It matters because the duties now arriving fall on the reading side. Article 50 asks deployers to disclose AI-generated or materially altered media they publish. California's AB 853 goes further and, from January 1, 2027, requires large online platforms to detect the provenance data in content they distribute. Marking is a solved problem with 124 registered products. Checking is where the tooling is thin.

Narrow the list to products registered in the United States that declare image containers and six remain. ChronoVerify is the sixth, by conformance date and by public disclosure date:

"US-based" is not a judgment call; it means the record's product Distinguished Name carries C=US. A seventh US validator record exists and is not in that table: Sound Patrol declares audio and no image types.

What this changes if you are downstream of generated media

The listing does not add features and does not change verdicts. What it changes is that "we validate C2PA properly" stopped being a sentence you have to take on faith from a vendor, and became a record id you can paste into a procurement questionnaire.

The limits:

• A valid Content Credential means an image carries a signed provenance claim that has not been broken. It does not mean the image is true.
• No credential at all is the common case, not a verdict.
• A conformant read can report that a credential says the image came out of a generative model. Reading correctly and reading good news are different things.
• The listing covers four image types. Not GIF, TIFF, HEIC or HEIF, and not audio, video, or documents.

What you can do with it today

The verifier is free and public, no account needed. Drop an image in and read the verdict. Everything else is a short ladder:

• Free key. 100 verifications a month, no card.
• Pay as you go. $0.003 per verification.
• Single signed report, $29. One image, one signed PDF with an RFC 3161 trusted timestamp, verifiable offline, no account and no subscription. For when you need to hand someone a document rather than show them a dashboard.
• Scale, $299 a month. 200,000 verifications a month, signed reports included.

An API, Python and TypeScript clients, and a hosted MCP server all call the same validator that carries the record above, so an agent can run the check with no human in the loop.

Sources: the C2PA Conforming Products List (raw JSON, the source of every count in this post); the C2PA conformance explorer; C2PA specifications; EU AI Act Article 50; ChronoVerify's conformance record; the method and its limits.